08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
18/09/2024, 20:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
Size

61KB
MD5

8a6482ace82910ef617751edfa48fdd6
SHA1

fac0cfe15821914a9dd16ff9b50a633431ae1139
SHA256

08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53
SHA512

bfe8bb01c013a518db39abbdb95ad9f62c042791356943741a6b6986e409e385808643fde2b0f0319a95ee0bc230e666a8ef9716fd222097701cb00999e20f1b
SSDEEP

768:W7BlphA7dASbSjJJ1EXBwzEXBwdcMcwBcCBcw/tio/tiBhRKu:W7ZhA7dABJJ7TTQoQNKu

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3736) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\ALRTINTL.DLL.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\DVD Maker\es-ES\OmdProject.dll.mui.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Chuuk.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\Mozilla Firefox\locale.ini.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\settings.css.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_delay_plugin.dll.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\Windows Media Player\de-DE\WMPMediaSharing.dll.mui.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\tile_bezel.png.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\prev_rest.png.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXEV.DLL.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-io_ja.jar.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Uzhgorod.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SecStoreFile.ico.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-loaders.xml.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\Mozilla Firefox\updater.exe.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt.fca.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\msinfo32.exe.mui.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hovd.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-core-kit_zh_CN.jar.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\row_over.png.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core.xml.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\Java\jre7\lib\jfr\default.jfc.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\custom.lua.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libimem_plugin.dll.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\youtube.luac.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libopus_plugin.dll.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\Windows Journal\es-ES\jnwmon.dll.mui.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_pt_BR.jar.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Mendoza.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Nauru.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\ShvlRes.dll.mui.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\gadget.xml.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.extensionlocation.nl_zh_4.4.0.v20140623020002.jar.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationBuildTasks.resources.dll.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_concat_plugin.dll.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\js\calendar.js.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\Internet Explorer\en-US\iedvtool.dll.mui.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Azores.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Bucharest.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\ij.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\jmxremote.access.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hebron.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1250.TXT.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\spu\libmosaic_plugin.dll.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\Windows Media Player\it-IT\wmpnscfg.exe.mui.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\README.TXT.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground_PAL.wmv.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.Printing.resources.dll.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libreal_plugin.dll.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\core_ja.jar.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\gadget.xml.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-masterfs.jar.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_http_plugin.dll.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\misc\libaudioscrobbler_plugin.dll.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\MediaReceiverRegistrar.xml.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\css\RSSFeeds.css.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\weather.html.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll.tmp	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe

C:\Users\Admin\AppData\Local\Temp\08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
"C:\Users\Admin\AppData\Local\Temp\08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

Filesize
61KB

MD5
8ba9b851fb9e0eb93860715fd38075de

SHA1
db8aa8e7b182f608da256d0747819504be2201bc

SHA256
d9c3db09a8f892e5b12d70f1ba712f3208863c51a9cd9d7b575b0bf5342034c5

SHA512
46d71e462126371855741bafd96b36fc6d330b68158ff447b3f815b3c60d02a6afcee252821c703889901236119496013f4643329880784a84d0d395aaaa1949

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
70KB

MD5
101a2896e7c2e7226870acd5fb9951fc

SHA1
82d24aaa71a990be7a47f10725acfef0b29df226

SHA256
09e94a11ccd75d2d51ba0328d597638475576e07b52bc739f0435c99a4a6d85c

SHA512
347d8d9610083a32ef145373033f67357339b827d9c8c1c6ef36ef2f1891bd297a6d037859f16f5be1d5ba7dc91d7149cf4a1f29b53d3f2aa20fe37b5c8a529f

Download Submit